Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects attempts to perform error-based SQL injection against WordPress instances associated with the wp2shell exploit chain. The rule monitors for the use of MySQL functions EXTRACTVALUE or UPDATEXML within query parameters that are typically targeted by the exploit (author_exclude, author__not_in) or when interacting with the batch REST endpoint.
Detects a POST to the WordPress REST API batch endpoint whose request body embeds a nested /wp/v2/users call granting the administrator role, consistent with the wp2shell exploit chain where a forged customize_changeset/parse_request replay temporarily assumes an existing admin's identity to pass current_user_can('create_users') and create a new administrator account without any preceding authenticated login. To reduce false positives from legitimate onboarding of administrator accounts, this rule now requires either the absence of an authenticated WordPress session cookie on the request, or a newly created username matching the randomized/generated wp2shell naming pattern (wp2_*, w2s_*).
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects the ZIP archive staged during the wp2shell WordPress RCE chain, identified by the embedded 'wp2shell_<hex>' directory/file naming convention later unpacked under wp-content/upgrade/ and renamed into wp-content/plugins/. Static content matching cannot distinguish a legitimate wp-admin authenticated plugin/theme upload from an attacker-staged payload landing in wp-content/uploads/ -- this rule enforces a fullword, exact 8-hex-character wp2shell_<hex> naming match and MUST be correlated with EDR/process telemetry confirming the ZIP was created by the web-server process (e.g. apache2/php-fpm) outside of an authenticated wp-admin upload session before triggering high-confidence alerting.
Detects the WordPress REST API batch-route confusion technique (CVE-2026-63030) via a malformed nested sub-request path combined with the co-occurring parse_path_failed/block_cannot_read/rest_batch_not_allowed error marker pattern.
Detects suspicious batch requests to the WordPress REST API (/wp-json/batch/v1) containing both a DELETE operation on category ID 0 and a POST operation to the core block-renderer, which is characteristic of attempts to exploit vulnerabilities like CVE-2024-27956 to achieve unauthenticated remote code execution.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects a POST to the WordPress REST API batch endpoint whose request body embeds a nested /wp/v2/users call granting the administrator role, consistent with the wp2shell exploit chain where a forged customize_changeset/parse_request replay temporarily assumes an existing admin's identity to pass current_user_can('create_users') and create a new administrator account without any preceding authenticated login. To reduce false positives from legitimate onboarding of administrator accounts, this rule now requires either the absence of an authenticated WordPress session cookie on the request, or a newly created username matching the randomized/generated wp2shell naming pattern (wp2_*, w2s_*).
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Detects SQL injection syntax smuggled into the author_exclude parameter via the WordPress REST API batch endpoint desync (CVE-2026-60137/CVE-2026-63030).
Detects UNION-based blind SQL injection against the WordPress REST posts item route exploiting the split_the_query bypass (CVE-2026-60137) to exfiltrate database contents.
Detects requests to WordPress plugin-install/upload or privileged user REST endpoints occurring shortly after anomalous WordPress REST API batch activity, consistent with post-exploitation follow-through in the wp2shell chain.
Detects unauthenticated POST requests to the WordPress REST API batch endpoint (/wp-json/batch/v1 or ?rest_route=/batch/v1) containing a nested requests array or an anomalous sub-request method pattern, the network entry point for the wp2shell CVE-2026-63030/CVE-2026-60137 exploit chain.
Detects anomalous server responses for WordPress REST API requests targeting /wp/v2/categories/0 where the error message 'block_cannot_read' is returned instead of the expected 'rest_term_invalid'. This behavior is indicative of attempted exploitation using the wp2shell batch-handler desync vulnerability.
Detects suspicious batch requests to the WordPress REST API (/wp-json/batch/v1) containing both a DELETE operation on category ID 0 and a POST operation to the core block-renderer, which is characteristic of attempts to exploit vulnerabilities like CVE-2024-27956 to achieve unauthenticated remote code execution.
Detects potential SQL injection attempts against Azure App Service endpoints (specifically /wp-json/batch/v1 and /batch/v1) by identifying SQL-specific characters in URI query parameters that correlate with SQL syntax error logs within a 5-minute window.
This rule detects a specific HTTP request pattern targeting the WordPress REST API batch endpoint. It identifies a malformed sub-request path containing a path string formatted as 'http://:', which is indicative of a 'route confusion' attempt, potentially leading to unauthorized operations or SSRF (Server-Side Request Forgery) within the WordPress environment.
Page 50 of 102